Can an administrator see all of my info on shared, private WiFi?

Question

I am currently sharing a WiFi network with my neighbor. We are on the same network. I never set up as a Guest.

My questions are:

• whether or not this person can see the sites I visit, the info I input on messages, business sites, and retail sites;

• if this person can see my personal e-mail messages, and facebook messages.

I don't know if you have to be tech savvy to be able to do this if this person chose so too.

Answer 1

Someone who has administrative access to the network you are connecting to can:

1. View the IP address and domain names of the site you're connecting to (based on DNS query and/or SNI in TLS) and which email provider you're using, irrespective of encryption. You can prevent this by using encrypted third party DNS (e.g. DNSCurve to OpenDNS).
2. The location of your access point (this is of little concern for you as you're physically neighbors anyway).
3. View and modify the content of any unencrypted traffic, including session keys/cookies, and passwords if they're traveling over unencrypted connection. View and modify emails traveling over unencrypted POP, IMAP, SMTP, or unencrypted web mail.
4. Block access to any site or protocol, irrespective of encryption. This may in many cases be circumvented with a VPN/proxy. In extreme cases, the administrator may block all proxies, VPN, and Tor.
5. View and modify encrypted Wi-Fi packets and its content, that is not further encrypted (e.g. with TLS)

They can't:

1. View and/or modify content, session keys/cookies, or password traveling inside end-to-end or user-to-service encryption (e.g. PGP, TLS). Snooping into these type of encryption can only be done if your neighbor installed a malware/certificate in your computer
2. View or modify the content of emails or who you are sending email to when using POPS, IMAPS, SMTPS, or encrypted web mail.

Doing these kinds of interceptions do require a little tech saviness, but it's not actually that difficult if they really wanted to learn how to snoop on you.

Also note that there are a number of other non privacy risks with sharing connection with others. For example, if your neighbor accessed illegal activity, they could potentially implicate that on you and you could be dragged into these legal problems.

Answer 2

Wifi (even with password) is usually set up as being security equivalent to an open wired network (plug in to network, you are presumed to supposed to be on it).

All communcation by any party on the network is fully visible. Security can be applied on top of the unsecured communication, but an open wired network has next to no security built-in (other than being able to physically connect to the wires).

Some wired networks packet switch, where only the packets you are supposed to see are sent to you. Wifi networks are not that secure, they are as only secure as the wired networks that send every packet to everyone (which is not very).

Other users on such a network can view easily, and modify with some difficulty, data you transfer over unencrypted protocols.

Now, on top of the network layer, you can have a secure layer; with good protocols, the insecurity of the network layer won't matter (that much -- the network layer could still deny service).

Communication over a secure protocol will thus remain private.

However, DNS lookups are not that private. DNSsec provides origin authentication of DNS data, but not confidentiality. So even over https, someone on your open wired network (or wireless-equivalent wifi) can tell what websites you are visiting. With https, they won't see what you are looking at, but they will know what websites.

Similar secure protocols exist for email and other services; often, the place you are connecting to is public, but what you communicate is private.

If you install something like Tor, or use a secure VPN, you can make the lack of privacy on your wifi not important.

I do not know the security state of facebook messages. But, presuming the engineers are competent (encryption/security is hard, so not guaranteed), it is probably roughly as secure as https, where the fact you are using facebook messages is public, but what and to whom you are sending it is not.

On top of the above, if they have access to your wifi, they could try some man-in-the-middle attacks; things like protocol degrading to an easier to break protocol. This is relatively advanced, can be mitigated by upgrading either the client (your web browser) or the server (to refuse to provide insecure protocol connections), and is not nearly as passive as what can be gathered over insecure connections.

The easy way to to mitigate this is to set up a guest wifi. With a poor configuration they might be able to do some mischief, but the level of sofistication goes from "relatively easy" (most of the above) to "it would be easier for them to hack your router".

There are wifi networks that provide "packet switching" (or better) levels of security (Like WPA2 Enterprise). You probably are not using one.

Answer 3

Any unencrypted data sent over Wi-Fi is potentially vulnerable. Some questions:

• Is the connection encrypted? (look for WEP, WPA, or WPA2 in the connection details)
• Are you using a virtual private network or IPsec?
• Are the sites you are visiting using encrypted connections? (in particular, look for a lock icon in the URL bar)

If you answered yes to any of those questions, then your data should be safe.

Also bear in mind that it's very unlikely that your neighbors would snoop like that - in most Western and Westernized countries, eavesdropping on communications is illegal.